Guide
What Base64 is (and is not encryption)
Base64 turns bytes into ASCII so they survive email, JSON, and URLs. Anyone can decode it. It is not a lock.
Updated 2026-08-17
The actual problem Base64 solves
Computers store bytes. Many channels only want printable ASCII: email bodies of a certain vintage, some JSON fields, HTTP basic-auth headers, data URLs in HTML. Base64 maps every three bytes onto four characters from a 64-symbol alphabet (A–Z, a–z, 0–9, +, /) plus = padding. The result is longer — about 33% — and boringly reversible.
Reversible is the point. The receiver runs the inverse map and gets the original bytes. There is no password and no key. If you can read the Base64 string, you can recover the content in a second. Treat it like a shipping crate, not a safe.
Where you will see it
Inline images (data:image/png;base64,...), JWTs (three Base64url segments), mailbox attachments, and Kubernetes secrets that are Base64-encoded YAML — still not encrypted unless something else wrapped them. URL-safe Base64 swaps +/ for -_ and often drops padding so the string can sit in a query parameter.
UTF-8 text should be encoded as UTF-8 bytes first, then Base64. Naïve btoa() in JavaScript used to throw on emoji; a correct tool encodes Unicode first. Decoding then has to reverse that path or you get mojibake.
Common decode errors
Invalid characters, missing padding, or a truncated string will fail. So will treating Base64url as standard Base64 without translating the alphabet. If a string is gzip+Base64, decoding once yields compressed bytes, not readable text — that is not a broken decoder.
You cannot “Base64 encrypt a password” and call it done. Anyone who intercepts the string decodes it. Use TLS in transit and a real password hash (or a KDF) at rest. Base64 is only the representation.
Using a browser encoder
Paste plain text, encode, and you should get a stable ASCII blob. Paste that blob, decode, and you should get the same text. If you are checking an API example, compare against the language library your service uses (Node Buffer, Python base64) — they should agree on standard Base64.
Do not paste production secrets into any encoder you do not trust. The tool on this site runs in the page, which is why it exists as a quick check, not as a pipeline for credentials.
Related tool: Base64 Encode/Decode